University of Cincinnati Limited HIPAA Glossary

Transcription

1 University of Cincinnati Limited HIPAA Glossary ephi System A system that creates accesses, transmits or receives: 1) primary source ephi, 2) ephi critical for treatment, payment or health care operations or 3) any form of ephi and the host system is configured to allow access by multiple people. Examples include: A personal computer with a database containing ephi that is configured to allow access by more than one person. A departmental server with file shares containing ephi. A computer system used to create, access, transmit or receive ephi that is configured to allow access by a non UC vendor/contractor. A clinical care system, which contains primary source ephi. A billing system that is critical to clinical care operations. Administrative Safeguards Administrative actions and policies and procedures (1) to manage the selection, development, implementation, and maintenance of security measures, and (2) to protect ephi and to manage the conduct of the designated health care components workforce in relation to the protection of ephi. Business Associate Generally an entity or person who performs a function involving the use or disclosure of electronic Protected Health Information (ephi) on behalf of a covered entity (such as claims processing, case management, utilization review, quality assurance, billing) or provides services for a covered entity that require the disclosure of ephi (such as legal, actuarial, accounting, accreditation). Contingency Plan Sets out a course of action that is maintained for emergency response, backup operations, and post disaster recovery. The purpose of the plan is to ensure availability of critical resources and facilitate the continuity of operations in an emergency. The plan includes procedures for performing backups, preparing critical facilities that can be used to facilitate continuity of critical operations in the event of an emergency and recovering from a disaster. Data Center a centralized repository for the storage, management, and dissemination of data and information organized around a particular area or body of knowledge (e.g., university financial and HR data, or patient scheduling, billing and medical records). At the University of Cincinnati this refers to centrally managed data centers operated by UCIT. Disaster Recovery Plan The part of a contingency plan that documents the process to restore any loss of data and to recover computer systems if a disaster occurs (i.e., fire, vandalism, natural disaster, or system failure). The document defines the resources, actions, tasks and data required to manage the business recovery process in the event of a business interruption. The plan is designed to assist in restoring the business process to attain the stated disaster recovery goals.

2 De-identification The process by which identifiers are removed from PHI. De-identification Standard Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information. See Safe Harbor De-identification. Disclosure The release, transfer, provision of access to, or divulging in any other manner of protected health information outside of the entity holding the information. Electronic Protected Heath Information (ephi) is PHI in electronic form. Emergency Mode Operation (EMO) plan is a subset of a disaster recovery plan that documents processes that support continued operation in case of an emergency. Emergency mode operations documentation includes emergency management/crisis management guidelines and procedures to maintain the integrity, availability and confidentiality of protected health information. Encryption - The process of encoding a message using an algorithmic process to transform data so that it can be read only by the sender and the intended recipient with the use of a confidential process or key. This can also be applied to data at rest (stored data), so that only the owner of that data can read the data. This includes the transmittal of texts, messages, and file storage. Extranet An extension of the designated health care component s intranet to users that are physically located outside of the organization for specific purposes such as research. Users connecting to a designated health care component s intranet via a Virtual Private Network (VPN) is considered an extranet. Health Care Component means a component of a hybrid entity designated by the hybrid entity that function as a health care provider, as defined by HIPAA. Hybrid Entity a single legal entity such as University of Cincinnati that is a covered entity whose business activities include both covered and non covered functions. Information Security Incident Any activity that harms or represents a serious threat to the whole or part of UC s computer, telephone and network based resources such that there is an absence of service, inhibition of functioning systems, including unauthorized changes to hardware, firmware, software or data, unauthorized exposure, change or deletion of ephi, or a crime or natural disaster that destroys access to or control of these resources. Routine detection and remediation of a virus, malware or similar issue that has little impact on the day to day business of the University is not considered an incident under this policy. Non-university device Devices not owned or supported by the University of Cincinnati (e.g., storage, computing or communication tools, such as computers, laptops, tablets,

3 smartphones, cell phones, personal data assistants, external hard drives, thumb drives). PHI Protected Heath Information (ephi) is any information, whether oral or recorded in any form or medium that is created or received by a covered entity that identifies an individual or might reasonably be used to identify an individual and relates to: The individual s past, present or future physical or mental health; OR The provision of health care to the individual; OR The past, present or future payment for health care. Information is deemed to identify an individual if it includes either the patient s name or any other information that taken together or used with other information could enable someone to determine an individual s identity. (For example: date of birth, medical records number, health plan beneficiary numbers, address, zip code, phone number, address, fax number, IP address, license numbers, full face photographic images or Social Security Number. PHI excludes individually identifiable health information in education records covered by the Family Educational Right and Privacy Act (FERPA) and employment records held by a covered entity in its role as employer. Physical Safeguards Measures, policies, and procedures to physically protect the designated health care components systems and related buildings and equipment that contain ephi, from natural and environmental hazards and unauthorized intrusion. Portable electronic device All devices that support mobile computing or communications, and have the ability to store data including, but not limited to: Laptops Smartphones, PDAs, iphones, cellular phones Tablet devices (such as ipads), notebooks External hard drives Zip drives CDs DVDs USB thumb, flash or jump drives Diskettes Cloud services (such as Internet based file storage services) Remote Access Any access to a device on the University of Cincinnati data network through a non UC managed network, device, or medium, for example by DSL, cable modem or dial up connection. Risk Analysis A documented assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ephi, and an estimation of the security

4 measures sufficient to reduce the risks and vulnerabilities to a reasonable and appropriate level. Risk analysis involves determining what requires protection, what it should be protected from, and how to protect it. Safe Harbor De-identification The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed: (A) Names (B) All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their equivalent geocodes, except for the initial three digits of the ZIP code if, according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all ZIP codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer people is changed to 000 (C) All elements of dates (except year) for dates that are directly related to an individual, including birth date, admission date, discharge date, death date, and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older (D) Telephone numbers (E) Fax numbers (F) addresses (G) Social security numbers (H) Medical record numbers (I) Health plan beneficiary numbers (J) Account numbers (K) Certificate/license numbers (L) Vehicle identifiers and serial numbers, including license plate numbers (M) Device identifiers and serial numbers (N) Web Universal Resource Locators (URLs) (O) Internet Protocol (IP) addresses (P) Biometric identifiers, including finger and voice prints (Q) Full-face photographs and any comparable images (R) Any other unique identifying number, characteristic, or code; and the covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information. System Any electronic computing or communications device or the applications running thereon which can create, access, transmit or receive data. Systems are typically connected to digital networks. Examples of systems include: A computer system whether or not connected to a data network, A database application used by an individual or a set of clients, A computer system used to connect over a network to another computer system, An analog or digital voice mail system,

5 Data network segments including wireless data networks, and Portable digital assistants. System Administrator the technical custodian of a system. This individual provides the technology and processes to implement the decisions of the system owner. In some circumstances, the system administrator and the system owner may be the same person. System administrators are responsible for the technical operation, maintenance, and monitoring of the system. These duties include implementing appropriate technical, physical and administrative safeguards. System Owner the authority, individual, or organization head who has final responsibility for systems which create, access, transmit or receive ephi and including responsibility for the ephi data. In some complex systems, the functional responsibility for the system and the responsibility for the data may lie with more than one individual. Decisions regarding who has access to the system and related ephi data and responsibility for the risk analysis rest solely with the system owner. The system owner usually delegates responsibility for the technical management of a system to a qualified system administrator or staff who are capable of implementing appropriate technical, physical and administrative safeguards. Technical safeguards the technology, and the policy and procedures for its use that protect electronic protected health information and control access to it.